Dlazy Jimeng T2i

• Outcome: Pass
• Latest audit: Jun 2, 2026 at 10:28 AM UTC
• Version:
  1.2.0

Overview

This skill is a disclosed wrapper for dLazy Jimeng text-to-image generation, with expected API-key use and cloud uploads.

Install only if you are comfortable using the dLazy CLI, storing or passing a dLazy API key, and sending prompts plus any referenced local images to dLazy's hosted service. Avoid passing private files unless you intend to upload them, and review the @dlazy/cli package/source before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation states the skill itself will not overreach network or filesystem access, but the very next bullets say prompts are sent to api.dlazy.com and local files may be uploaded to files.dlazy.com. This mismatch can mislead users and agents about data handling, causing accidental disclosure of sensitive prompts or local files under a false expectation of limited access.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases include broad everyday expressions such as '生成图片、文生图' and especially '画一张图', which can cause the skill to activate in situations where the user did not intend to invoke this specific external SaaS tool. In this skill's context, unintended activation is more dangerous because it can send prompts to a remote API and potentially upload referenced local files.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger keywords include broad, everyday phrases like "generate image, text to image" and "draw a picture," which can cause the skill to be invoked unintentionally in normal conversation. Because this skill performs authenticated networked actions and may upload local file paths to external services, accidental invocation increases the risk of unintended API usage, data transfer, and user confusion.

VirusTotal

63/63 vendors flagged this skill as clean.